SAP Security Notes, January 2019
Hot News Note 2696233 deals with multiple vulnerabilities in the SAP Cloud Connector. The Connector is an agent that connects on premise systems with applications operating on the SAP Cloud Platform. The agent supports HTTP, RFC, JDBC/ODBC and other connections between on-premise and cloud installations using reverse invoke without requiring inbound ports to be opened in on-premise network firewalls. Therefore, the Connector is designed to support secure cloud and on-premise connectivity. Note 2696233 patches a missing authentication vulnerability in the SAP Cloud Connector with a CVSS score of 9.3/10. It also addresses a lower-risk code injection vulnerability that could lead to information disclosure or a denial of service in the Connector. Customers are advised to upgrade to SAP Cloud Connector 2.11.3 to remove the vulnerabilities.
Hot News Note 2727624 includes corrections for removing a critical information disclosure vulnerability in SAP Landscape Management. Landscape Management supports system cloning, copying, refreshing and other system administration tasks. The vulnerability addressed by Note 2727624 could be exploited by attackers to steal user credentials. The note recommends deleting entries in log files and changing passwords for system users that may be disclosed in logs.
Other high priority notes include 2727623 which removes a missing authorization check in SAP BW/4HANA and Note 2724788 which tackles various vulnerabilities in the Adobe PDF Print Library.
